Slashdot Mirror


Netscape 6 is Spyware?

spoon00 writes: "AOL is collecting information on what Netscape 6 users are searching for on sites like google.com. IP address, the date Netscape was installed and a unique ID number are other bits of information AOL is also collecting."

64 of 647 comments (clear)

  1. Now it's time.. by dimer0 · · Score: 5, Funny

    Now it's time to skew their numbers, .. I think I'm going to have to do about 14million automated searches for "CROSSDRESSING MONKEY PORNO" using their search bar..

    1. Re:Now it's time.. by prizzznecious · · Score: 5, Funny

      Considering that your IP is included in that info-bundle they get, you should expect to see some very exotic targeted advertising if you embark on that campaign.

      --

      visit the hwky website for a lyrical genius infusion.
    2. Re:Now it's time.. by smoondog · · Score: 5, Funny

      Here's the link for that:

      Google Search: Crossdressing Monkey Porno

      Just doing my part. (I think its funny how google suggests that I meant porn. Anyway,
      shouldn't that be pr0n?)

      -Sean

  2. Easy Solution by BurritoWarrior · · Score: 5, Informative

    Don't use it. Uninstall NS6 and use Mozilla instead. Same browser - without the unnecessary extra crud AOL bundles into it anyhow.

    1. Re:Easy Solution by Metrol · · Score: 5, Interesting

      Don't use it. Uninstall NS6 and use Mozilla instead.

      By chance would you happen to have the "Related Sites" tab enabled (as is by default) in your installation of Mozilla? Don't care if you've ever used the side bar or not, as it doesn't matter.

      Even Moz sends back some kind of information Alexa. Came to discover this one day using my laptop off-line on a web site I had running locally. Couldn't figure out why I kept getting these intermittent "Can't connect to network" messages. Had me going nuts, thinking there was some glitch with my site code.

      I haven't a clue what kind of information Alexa is having sent to them. I do know that if you turn that tab off, Moz stops feeding information that way.

      --
      The line must be drawn here. This far. No further.
    2. Re:Easy Solution by DeadMeat+(TM) · · Score: 5, Informative
      That's a good idea for most /. readers, but Mozilla isn't really an end-user product; it lacks some of the polish of commerical browsers. Also Netscape 6.x has the advantage that, after branching, the Netscape team beats some of the bugs out of it. I personally use Mozilla, but when I "evangelize" a Windows browser, it's Netscape 6.2.1.

      That said, the "spyware" here is really annoying, but it's disabled easily enough. Open prefs.js and change pref("browser.tracking.enabled", true); to false, and you're done.

      A better way to go if you do this a lot is to use the Netscape CCK to make your own CD without all the AOL crap included. The CCK won't let you edit this pref directly, but unzip browser.xpi and look for this line in all-ns.js. You can also make some interesting changes in the .js files in bin/defaults/pref -- like turning off all those AOL "partner" buttons by default and disabling the activation procedure.

    3. Re:Easy Solution by Keith+Russell · · Score: 5, Informative

      Preferences only allows you to ban domains from What's Related. To remove the tab entirely, open your sidebar, click the Tabs dropdown, then select Customize Sidebar.... If What's Related is in the Tabs in Sidebar list, remove it.

      --
      This sig intentionally left blank.
    4. Re:Easy Solution by DeadMeat+(TM) · · Score: 4, Insightful
      I'm on a college campus. Since people set up floor and campus mailing lists which inevitably get added to address books, we get a ton of E-mail worms being spread around. (Fortunately for me, the different schools have different mail servers, and it looks like the engineering school's mail server has some kind of server-side scanning on it.) It eventually got so bad that the entire arts & sciences school lost E-mail for two days thanks to one of the recent worms (I don't remember which) which practically made their server go up in flames. The only problem that's worse around here is spyware (*cough* New.net *cough*) killing peoples' Internet connections, and that's relatively recent, since people pick it up from recent versions of P2P apps.

      So yeah, when people come up to me and ask "How can I stop all these E-mail viruses," I give them an honest answer: don't open E-mail attachments you're not expecting, update your virus scanner manually when you hear about a new worm (fortunately the copies of NAV our school gives out is pre-configured to automatically update itself every couple of weeks), and stop using Internet Explorer and Outlook Express. Their options are basically Netscape and Opera -- and most college students (myself included) are reluctant to cough up the registration fee for Opera, so that leaves one option.

      I'm not going to go into the debate of whether the IE/OE combination is so dangerous because of Microsoft being incompetent or simply because 80something percent of the world uses it (it's been argued way too many times). But either way, switching to Netscape works, and so far nobody's complained. I've even gotten a couple of "ooh, pretty" comments once people saw Netscape's Modern theme.

  3. When will laws be passed? by CitznFish · · Score: 3, Insightful

    When will we all finally be so fed up at the consistent invasions of our privacy by media moguls like Real networks, AOL, Netscape (yeah one and the ame..)? We neeed to contact our legislators and demand these practices stop. Maybe if anonymous data was gathered, but to tie it with an IP address really goes beyond any justifiable data collection.

    --
    'mmmmmmmmm.... forbidden donut'
  4. Very old news. by Doktor+Memory · · Score: 5, Insightful
    Netscape's internal search components have been collecting information (to be processed by Alexa) since the late 4.x versions.

    --

    News for Nerds. Stuff that Matters? Like hell.

    1. Re:Very old news. by Metrol · · Score: 3, Informative

      Wish I saw this post prior to mine on an earlier thread. Mozilla is still doing this very same thing by default. At least with Moz you can turn it off though.

      Thing is, how many folks realize this is even happening? Whatever is being sent it's subtle, even for a dial-up connection.

      --
      The line must be drawn here. This far. No further.
    2. Re:Very old news. by HiThere · · Score: 3, Insightful

      It's only old news if you've already heard it. I hadn't.
      .

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
  5. Doesn't XP/IE 6 Do The SameThing? by Tesser · · Score: 5, Insightful

    According to IE 6/XP's "Search Companion", this feature "provides task suggestions and automatically sends your search to other search engines."

    How does this occur if it doesn't transmit the information to Microsoft as well?

    Sure, if I add a search engine into the preferences, I can type "google keyword" all I want to go directly to Google. I suspect, though, that if I rely on the "features" that Microsoft provides, they have access to exactly the same information-- regardless of what the article might claim.

    1. Re:Doesn't XP/IE 6 Do The SameThing? by Krelnik · · Score: 5, Informative
      Yes, the article got this wrong. IE does the exact same thing if you use what they call "Auto Search".

      In IE 5.5 or 6.0, if you click the SEARCH button, then click CUSTOMIZE in the panel that appears, you can choose which engine that IE uses to search for you. If you then click AUTOSEARCH SETTINGS you can set a default search engine.

      Once this is done, you can type search terms in the URL box, and if they can't be somehow interpreted as a hostname or domain name, they get routed to your favorite search engine.

      But not directly! They go through the host auto.search.msn.com. You can see this quite easily even if you don't have a sniffer. Simply edit your HOSTS file under Windows to redirect the name auto.search.msn.com to some other address, like the loopback address (127.0.0.1). Once you do this, your auto-searches will start failing with 404's, and you will see the URL they use to do the redirection.

      I've wondered for a long time what Microsoft does with this data. Fortunately, if you are willing to do a little registry hacking and a tiny bit of extra typing, you CAN avoid this in IE. You can create keywords like "google" that you type first in the URL box, before your search term, and these are redirected from your chosen registry setting to the search engine. These do NOT redirect through MSN so Microsoft can't spy on you. Instead of typing just the "my search term" in the URL box, you type "g my search term" and it goes right to google (or whatever).

      This latter ability has existed since IE 3.0, but in current versions of IE it has NOTHING configured in it by default. However, if you download this free tool from Microsoft, it adds a way to configure them. Why is this hidden off as a free download instead of included with IE? Dunno, but feel free to insert your favorite conspiracy theory here.

  6. Simple solution by Vortran · · Score: 4, Funny

    pico /etc/hosts

    127.0.0.1 www.netscape.com

    --
    Knowledge is like ignorance.. too much can be just as bad as not enough.
    1. Re:Simple solution by photon317 · · Score: 5, Funny


      Real men use vi.

      --
      11*43+456^2
    2. Re:Simple solution by 10am-bedtime · · Score: 3, Insightful
      real men use vi

      well i'm glad my non-computer-geek girlfriend uses emacs, then.

      thi

  7. I overreact as much as the next guy... by quinto2000 · · Score: 5, Insightful
    but the article is pretty clear that the data are anonymized and for billing purposes only. Microsoft might not need to collect data on how often their users use affiliated search engines, but Netscape isn't in a position where they are free to lose money.

    Netscape needs to collect information about the frequency of searches in order to bill the search engines correctly. The very fact that it only occurs in the "Search bar" shows that they are very likely to be telling the truth. It wouldn't be hard to log much much more data than they apparently do.

    The commment about the ip address was misleading as well. Any time that information is sent to my computer, I can log the IP address. It doesn't mean that I am going to be doing anything with it.

    --
    Ceci n'est pas un post
    1. Re:I overreact as much as the next guy... by Zeinfeld · · Score: 4, Insightful
      The commment about the ip address was misleading as well. Any time that information is sent to my computer, I can log the IP address. It doesn't mean that I am going to be doing anything with it.

      Netscape should know that logging of IP addresses has severe privacy issues, they were a major source of controversy in the early days of the Web.

      This could easily be abused for corporate espionage. It is very easy to correlate addresses with companies - particularly if they have a NAT box and reverse DNS.

      This is also introducing a single point of interception for law enforcement, including in police states. People in China trying to access Google to find out about "Tiannamen Square Massacre" could be redirected to the communist party search engine by simply redirecting a single DNS record.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    2. Re:I overreact as much as the next guy... by sjames · · Score: 5, Insightful

      Netscape needs to collect information about the frequency of searches in order to bill the search engines correctly.

      If all they need is aggregate information, why is there a unique id number and date of installation? Why not have it send a packet saying for example "google search" and then send the search itself directly to google?

    3. Re:I overreact as much as the next guy... by baka_boy · · Score: 3, Informative

      It's been mentioned in other parts of this discussion, but I'd just like to re-iterate a simple, important concept: every HTTP request includes the client IP address as a component. In fact, most web servers automatically log the address of the client making each and every request.

      That's right, kids and kid-ettes: every time you load a web page, your IP address is probably getting logged along with the request. Does that mean that Google could (if they cared, that is) associate every single pr0n search you've done with the IP address of your computer, find out that it was part of your employer's class-C block, and notify them? Damn straight, they could.

      Do they? That's up to them (or a court-ordered search) to say; this information is certainly there, if they want it.

  8. So what if it's not a surprise.... by Muddie · · Score: 4, Insightful

    It shouldn't be tolerated. People shouldn't be informed they are being spied on and say, "Eh, I figured as much anyway." Would you say that if you found that the CIA had been wiretapping your phone line and/or DSL/Cable line for the past 6 months?
    I haven't read the licence agreement to Netscape 6 recently, but I don't care if it says anything about monitoring your browsing trends (it's hard to call them 'habits' due to the very definition of the word). It almost appears as people are becoming complacient about this. If you get used to it, they will just push further once they have their hand in your privacy and you don't flinch. Eventually, it may come down to a /. headline, "MS-AOL using tiny dust-sized robot probes that ship with Windows 3K that get into your nostrils, sit behind your eyes and monitor everything you do." *shutter*
    Once more a large company is stepping on your rights and your privacy, and while maybe you shouldn't be suprised, you should be outraged.
    Please?
    Pretty please?

    1. Re:So what if it's not a surprise.... by Tackhead · · Score: 4, Funny
      > People shouldn't be informed they are being spied on and say, "Eh, I figured as much anyway." Would you say that if you found that the CIA had been wiretapping your phone line and/or DSL/Cable line for the past 6 months?

      Hell yes, I'd be surprised! The 6-month anniversary of 9/11 is still three days away! (You'll have to ask me again Monday morning ;-)

      Then again, I trust the spooks to keep whatever they know about me private; that is, I trust them a hell of a lot more than I trust AOL/TW's marketing department.

    2. Re:So what if it's not a surprise.... by Tackhead · · Score: 3, Interesting
      > > > Then again, I trust the spooks to keep whatever they know about me private; that is, I trust them a hell of a lot more than I trust AOL/TW's marketing department.
      >>
      >>You shouldn't.
      >
      >Sure you should, but not because they're "nice guys". They'll keep what they know about you private because to not do so is to admit what they know about you.

      Good point. (And the spooks, unlike the marketroids, have not just a vested interest in keeping things secret, but they also have experience in doing so.)

      The other point worth making is that I choose to trust the spooks with my info when I send mail without using PGP (whups, another /. thread), or post/read Slashdot, etc. Informed consent.

      (No, Joe Sixpack isn't giving informed consent, because he might be surprised at the level of surveillance -- but anyone who's thought about it even pre-9/11 should realize that if it's loggable, it's reasonable to assume it's being logged.)

      Back to the Netscape topic - I don't think people are as pissed about the redirect through the netscape.com search-logger, as they are about the fact that they were never told this was happening in the first place.

      (Again, Joe Sixpack isn't giving informed consent -- but if I, having read this article, continued to use Netscape and used the search toolbar without disabling the redirect -- I'd then be giving informed consent to AOL to log my queries.)

  9. Re:Glad I use mozilla... by reaper20 · · Score: 4, Insightful

    True, but considering that a lot of people still think that Mozilla == Netscape, it still becomes a problem for Mozilla, granted it's only perception, but try explaining that to the "average" user.

  10. Any data mining a product does on user by Vicegrip · · Score: 5, Insightful

    behavior and information is something a product should clearly and regularly identify it is doing to the customer. Customers are generally willing to cooperate when they perceive there is value to the free product/service they are getting-- but only if they understand exactly what is being recorded, when, and how.

    Having to worry about software doing stuff behind your back without informing you is exactly the reason why I go to great lengths to avoid using Windows Media and why I don't use a number of current gnutella clients.

    --
    Do not spread "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" over the internet, thank you.
  11. Sloppy Journalism by guttentag · · Score: 5, Interesting
    From the article:
    According to a network traffic analysis performed by Newsbytes, Netscape is capturing Navigator 6 users' search terms, along with their Internet protocol (IP) address, the date Navigator was installed and a unique identification number.
    This should be easy for AOL to deny, since there is no product called Navigator 6. It's simply called "Netscape 6" now. You could argue that this is a minor detail the reporter screwed up, but I think you have to question the reporter's understanding of a subject if he doesn't know the name of the product he's writing about.

    In journalism schools, getting a name wrong earns you an automatic failure. Apparently Newsbytes doesn't hold its reporters to such a high standard.

  12. Re:Glad I use mozilla... by AlexDeGruven · · Score: 4, Insightful

    The problem with that is, it works exactly the way they want it to. The computer savvy people in the world know what they want to search for, and how to find the engine of their choice. What they're targeting are the inexperienced users who don't know any better. They are the ones that will actually use the Netscape search function, and not notice the fact that your information is being redirected to the parent company before it actually goes where you intended it.
    It falls under the same category as the Ameritech/SBC debacle here in MI. People who don't read all the way through their phone bill may not have noticed the "SBC/Ameritech intends to sell it's customer data to a 3rd party marketing firm, if you don't want your information to be included, be sure to call 800-xxx-xxxx to be removed from the list." in very fine print in an obscure section of the bill.
    Hardline marketing strikes again.

    --
    Randal Graves says: I'm a firm believer in the philosophy of a ruling class... Especially since I rule.
  13. Re:And the #1 search term intercepted by AOL? by TheMatt · · Score: 5, Funny

    I was going to say: "uninstalling Netscape".

    Maybe that will be today's!

    --

    Fortran programmer...oh yeah. Array math for life!

  14. Re:Glad I use mozilla... by FatRatBastard · · Score: 4, Insightful

    Show me the "average" user who even knows what Mozilla is!

    I'm not knocking the browser, its the browser of choice on my Lin box, but lets face facts: its a geek browser. Joe user has no idea what it is.

  15. Re:any surprise? by Zeinfeld · · Score: 5, Insightful
    Really once aol took over is this any real surprise?

    I hope so because that is what any privacy suit would turn on. Does the user expect AOL to intercept searches and log the results?

    The Windows XP 'powertool' has a very useful feature that allows you to enter a shortcut for a search engine. So if I type 'g privacy' it sends off a search to Google for 'privacy'.

    I just hope that the Slashdot community will have the guts to go after AOL for this in the same way they would Microsoft. As it is I suspect the response will be a bit like the response in Congress to administration stonewalling or the like. Outrage at the actions if it is the other party, appologism if it is their own party, or even outrage that people would even complain.

    Netscape has never been pro-privacy. They invented cookies so that advertisers could track readers and now they are tracking them directly themselves.

    --
    Looking for an Information Security student project suggestion?
    Try http://dotcrimeManifesto.com/
  16. Re:Glad I use mozilla... by Eimi+Metamorphoumai · · Score: 4, Insightful

    I don't think so. First of all, most people don't understand the idea of spyware at all, or simply don't care. For those who do, you now have a really simple answer to what is Mozilla: "It's Netscape without the Spyware and other corporate crap."

    --

    Visit me on #weirdness on the Galaxynet.

  17. It uses DNS, block it in /etc/hosts by BlowCat · · Score: 3, Informative
    The article says that Netscape goes to Google by loading a URL beginning with "http://info.netscape.com/"

    Therefore, the temporary workaround would be to set info.netscape.com to 127.0.0.1 in your /etc/hosts (or c:\windows\hosts or whatever). The solution is to use Mozilla and remove Netscape 6.

  18. Re:For God's sake by Tackhead · · Score: 5, Insightful
    > And you're bitching about AOL collecting some lousy anonymized demographics???

    With the unique identifier, and having every search query you ever enter pass through a netscape.com redirector, yeah, he's got a right to bitch.

    What's anonymous about this? It's one cookie (from a bank, or a broker, or some other site to which he's given real data) and one SQL join away from having his entire search history linked to him.

    A redirector is transparently intercepting and logging the user's search queries.

    Whether it's www.netscape.com, www.fbi.gov, or www.doubleclick.net doing the intercept and redirect isn't the point. My search queries are transactions between me and Google. I can log 'em. Google can log 'em. They're nobody else's fsckin' business.

  19. Re:Figures! by simplexMethod · · Score: 4, Insightful
    Every program we run has some kind of SPY thing with it.

    Unfortunately for people like the person who made this general statement, privacy is probably unattainable.

    Web privacy is possible. Open source encryption programs i.e. OpenSSH (Secure SHell) allow users to pore over the code for security holes. I download all of my mail with SSH connections to the individual mail servers (even my yahoo.com address). This is obvoiusly not a total security solution but it does keep employers, coffee shops, etc... from reading bits of my mail.

    I just wanted to give an example of how your privacy fate is in your own hands...
  20. Re:So? by Wakko+Warner · · Score: 3, Insightful

    Perhaps they don't harass you or jail you yet.

    But -- and this is the absolutely salient point -- they could.


    Yeah, and they could send a squad of death ninjas after me too, or tickle me to death. But I'm quite confident the odds of either of these three things happening are about equal and probably an integer no greater than zero.

    Am I willing to trust them with my browsing info? I trust my employer to not give a shit that I'm reading slashdot right now. Why should I care one whit what AOL knows about the search keywords that come from my IP address?

    The chicken-little-syndrome on this site is absolutely astounding sometimes.

    - A.P.

    --
    "Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
  21. Don't be stupid by Hrothgar+The+Great · · Score: 5, Insightful

    While this argument does tend to be extremely one-sided at times on good ol' Slashdot, your implication that it should be a non-issue to people is preposterous.

    What you're basically saying is that AOL can do anything it wants with their browser, and anyone who thinks otherwise should either

    A. Stuff it
    B. Write a browser

    While just about anyone could choose (A), I believe you have greatly overestimated/exaggerated the amount of people who are capable of (B). Perhaps there are quite a few on Slashdot; certainly there would be a greater concentration of such people here than in the average American suburb; however, reacting to every argument over the ethics of data gathering in application software with "WRITE IT YUORSLEF!!!!!" might not be the most intelligent way to join the discussion. No one is going to listen to you in a debate if you act as if there is no debate and your point is totally obvious. Not everyone can write a browser; and most people are just going to use what's on their computer when they buy it. Arguing that spying on people who don't know any better and have no way to protect themselves *might* just be a little shady certainly is valid and does not warrant your instant dismissal.

  22. Not a problem for Mozilla by Kiaser+Zohsay · · Score: 3, Informative

    First, type http://info.netscape.com into URL bar, abd get forwarded to http://home.netscape.com.

    Then, edit C:\Winnt\System32\drivers\etc\hosts and add:

    127.0.0.1 info.netscape.com

    Close and reopen Mozilla and try http://info.netscape.com and get Connection refused (unless you run a local web server, of course) to prove that info.netscape.com is no longer accessible.

    Now, try a keyword search from the URL bar, which for me goes straight to google.com without a hitch.

    --
    I am not your blowing wind, I am the lightning.
  23. Re:any surprise? by poemofatic · · Score: 3, Interesting

    I just hope that the Slashdot community will have the guts to go after AOL for this in the same way they would Microsoft.

    Well, I agree with your sentiments, but what do you mean by "go after"?

    Rant on slashdot? Piss on netscape 6?

    Problem there is that it's built on Mozilla, so we can just use Mozilla instead. The fact that aol still sponsors Mozilla development under gpl and mpl makes people a bit more lenient in terms of what they do with their branded browser. With MS, it's a different story.

    --

    When in doubt, have a man come through a door with a gun in his hand.

  24. You either hard code the site or... by blazerw11 · · Score: 4, Insightful

    It seems to me that it might just be that AOL/Netscape sends the search info "home" to make sure the search is correct. This way if Google (or any of the other possible search engines) decides to change how searches work, then you browser doesn't break.

    Also, all we know is what is sent, not what AOL collects.

    And finally, the search in Netscape is NOT sending the IP address of your computer, this is how HTTP connections work. The packet's origin is always included. Netscape 6 is also sending your IP address to every site you visit. As is IE, Opera, Mozilla, etc.

    --
    A great many people think they are thinking when they are merely rearranging their prejudices. -- William James
  25. Re:Glad I use mozilla... by bbqBrain · · Score: 3, Informative

    Not only will the unsuspecting "common" users not notice this, but they are also the only ones roped in by pop-under windows, gimmicky banner ads, spam, etc. AOL likely doesn't care upsetting the geeks because 1) We're in the minority, 2) We are mostly immune to the obnoxious advertising tactics described above*, and 3) The few friends we have don't listen to our rants anymore, anyway. :-) The scary part about this whole mess is that AOL has the ability to personally identify a user (even on a dynamic IP address) if a cookie is present, the user is logged into AIM, an AOL dialup account is being used, etc. Of course, we can't prove they do this, but can you think of any other reason to capture IP address along with the search terms?

    If they even cared to give the illusion of privacy, they would apply a hash function to the address. This would still allow the search terms from one "session" of searching to be associated with each other--the only valid use of the IP address I can conjure up. Of course, all they would have to do is apply the same hash to the IP address when you log in to any AOL-TW service, and they can match them, so it really is nothing more than an illusion, and we'd be back where we started.

    The lesson here, I think, is "Don't support companies that even attempt to compromise your privacy without explicit disclosure." It signifies dubious intent and even more dubious ethics.

    * My favorite Moz feature (other than tabbed browsing) has to be the option to disallow unrequested popup windows.

    --

    One of the reasons that I became a lawyer was to avoid ever having to hire one. -SPYvSPY
  26. Re:Glad I use mozilla... by blazerw11 · · Score: 3, Interesting

    Yes, it is a non-issue, here's why:
    1. All http requests send your IP address, they are making normal functionality seem sinister.
    2. No evidence is given that AOL is collecting the information.
    3. The redirect of the search through AOL/Netscape is simply to verify that the search engine is correct. If google were to change their site, the search would still work. However, IE's search would break.

    Who wrote this article?

    --
    A great many people think they are thinking when they are merely rearranging their prejudices. -- William James
  27. Re:Glad I use mozilla... by vondo · · Score: 4, Informative

    I asked on the mozilla newsgroups, someone did look at the code and saw nothing.

    Another person ran behind a firewall which asked about all connections. Netscape6 clearly went to an AOL address before connecting to Google. Mozilla went straight to Google.

    So while I personally haven't looked in the code, I'm pretty confident Mozilla is playing it straight on this one.

  28. Re:Glad I use mozilla... by TandyMasterControl · · Score: 4, Informative
    Jesus. Another multi-idiot pileup on the Cross-Clueville expressway....
    You know if Mozilla is sending data to AOL or not by sniffing for it with tcpdump or ethereal, etc.
    No funny packets? Don't bother sifting the source if you're not already involved.

    --
    Johnny Quest has two Daddies.
  29. Re:any surprise? by Zeinfeld · · Score: 4, Informative
    That makes about as much sense as saying "Spammers invented open relays so they could spew their crap across the Internet."

    The only thing SPAMers invented was spam and new techiques to spam.

    Cookies are not a part of the HTTP protocol. They are an extension that was originated at Netscape and deployed without any consultation in the IETF HTTP working group.

    Netscape knew that there were privacy issues with cookies but simply did not care. Until PGP cookie cutter came out the only way to turn off cookies was to have the browser ask you each time if you would accept them.

    --
    Looking for an Information Security student project suggestion?
    Try http://dotcrimeManifesto.com/
  30. Re:AOL/Netscape by Ryu2 · · Score: 4, Informative

    Mozilla and Netscape may seem identical, but they are very different:

    Even though it was started by Netscape, and Netscape employees make up a significant portion of its developers, mozilla.org is the independent and nonprofit organization to oversee the open source development of the Mozilla browser and its related technologies. mozilla.org's products are free for any company, organization, or individual, to use. They are free to create their own branded products based on mozilla.org's goods. mozilla.org's products are all open source and are meant for developers and testers, not the average computer user.

    Also keep in mind that mozilla.org recieves contributions from such large corporations such as IBM and Sun Microsystems, and countless small firms and volunteers.

    Netscape Communications is a commercial company, and they make commercial products for regular computer users and businesses.

    This is where the distinction between Mozilla and Netscape seems to blur to some people:
    In order for Netscape to make Netscape 6 they have to use mozilla.org's work. This involves getting that code from mozilla.org, adding modifications and non-open source parts such as plug-ins, branding it with the appropriate logos and copyrights, testing and stabilizing it, and then release it for download. In other words, Netscape 6 is based on Mozilla, but Netscape 6 is not Mozilla, and Mozilla is not Netscape 6.

    This method is similar to how Linux distributors, such as Red Hat, make their own branded and commercial releases of Linux, since Red Hat is not Linux, and Linux is not Red Hat. Red Hat merely uses Linux, and Linux developers have no control over what Red Hat does.

    The nature of Mozilla and mozilla.org also allows anyone to create a product based on Mozilla. For example, Nokia and Intel demonstrated prototype Internet appliances in late-1999 using Mozilla. Because of Mozilla's modularity, a scaled down version of Mozilla was the browser used in these test products.

    --
    There's 10 types of people in this world, those who understand binary and those who don't.
  31. Simpler way to disable autosearch in IE5+ by BACbKA · · Score: 4, Informative

    Whenever I am forced to use an IE on yet another corporate PC I get, I always go to the Tools/Internet Options/Advanced, and change some things to suit my taste on presentation and security (to the extent you can get the latter with IE...)

    security/more anonymous browsing
    DISABLE Install On Demand
    DISABLE Page Hit Counting
    DISABLE Page Transitions

    presentation
    DON'T Show Friendly HTTP messages
    (I want the plain servers response back, unedited, dammit!)
    DON'T Show Friendly URLs
    DON'T Use Smooth Scrolling (smooth scrolling makes my eyes SORE!!!)

    Search From Address Toolbar:
    DON'T Search From Address Toolbar

    (This is the one that completely toggles the autosearch off.)

    Security:
    turn all the certificate checks and alerts on

    also I use the "High" security zone settings for casual browsing

    --

    VKh

  32. Not really an issue by lkaos · · Score: 3, Informative

    The netscape search bar is meant to perform a search first of the netscape homepage IIRC, and then if relavant results aren't found, another search engine is chained.

    How often the second link of the searching chain is invoked is pretty critical in netscape figuring out how effective their search engine is.

    For those that remember the old Yahoo days when it used Altavista as a backup, it would appear to be a similiar situation. It would have been to Yahoo's advantage (and the end-users advantage) for Yahoo to track how well it's search engine performed and how often it had to default to alta vista.

    Now, AOL has come out saying they don't collect the information (and most folks on the net are behind a firewall or using a dynamic IP anyway) so it's not as big of a deal as it's being made out to be. This article mentions the 'potential' to be Spyware but it doesn't make clear the fact that in practice, AOL is not tracking anything.

    Besides, you can disable this feature if you are really nervous about it (as some folks mentioned previously). The fact of the matter is though, that by allowing AOL to collect this data, you are simpling improving your search results.

    BTW: This article also doesn't make it clear that if you goto www.google.com, nothing is tracked. The only time it is actually tracked is if you only enter a word (instead of a URL) in the location bar. I don't think many people use this feature that frequently anyway though. It's been there for a while though.

    --
    int func(int a);
    func((b += 3, b));
  33. mozilla source search by Roundeye · · Score: 4, Funny
    For those wondering whether this applies to Mozilla

    In xpfe components search datasets NetscapeSearch dot src there are 6 matches (see below).

    Looks to me like if you enable Netscape searches in Mozilla you get the same thing, but I don't see Mozilla reporting other searches to Netscape.

    As far as Alexa goes, since I see people asking about that too (results removed due to lameness filter), there is only one match of relevance, in the xpfe components related resources related-paned (dot) js file (see below).

    So, it looks like the "What's Related" panel is the only place where Alexa gets info from the browser.

    I had posted a find and grep command which showed 6 hits for the Netscape info information, and 5 hits for Alexa information in the Mozilla 0.9.8 source tree. Informative, terse, useful (IMHO). What follows is my commentary as I tried to get this post under the lameness filter -- resulting in the useless shit post you see above.

    Now evidently the last part of this triggered the wondrous lameness filter, so I'd like to say a few things here in hopes of getting this post past: first of all CmdrTaco is a fucking moron. Second what is the deal (and yes, I clearly have the source) with Mozilla's textarea entry widget? This thing is a nightmare to use. Don't even pretend to try to cut-and-paste into this thing if you want to produce readable results.

    That doesn't appear to be sufficient so I've removed the lines from the Alexa grep which just provide a copyright notice. CmdrTaco is a fucking mongoloid retard. Still no dice. Fucktard. Lamer fucking idiot. Fuck you and your monolithic Perl script.

    Ok. Gone are the info search lines which are in the layout bug tests (and not part of searching). Here's hoping. Nope, no dice. God I wish I were as fucking 1337 as CmdrTaco. I bet I'd get my ass slammed by homeless guys every fucking weekend. This site has become a shithole. How fucking useless. Censoring fucking retard. As if they have any fucking taste.

    Now I've taken out all the non-matching Alexa hits. Still no dice. Oh the fucking wisdom in enabling intellectual exchange by censoring trolls and spammers. Oh you've really done the community a fucking service by making it possible for us to edit our posts 12 times so we can have a truly enlightened exchange. You back-assed Michigan Nazi fuck.

    Took out the search path, no help, still too many "junk" characters. Too many junk-addicted assholes running this fucking site. I've now actually taken out the find and grep command I used to perform the searches, since I guess that's not informative. Let's see if that works. Nope. Colon off the end of the first sentence... Nope. I removed the path info for the files matching the netscape site... no help.

    This is the stupidest shit I have ever seen. I just took out all the matches for info.netscape.com and I'm still triggering the lameness filter. Finally, I removed the Alexa results as well and now the post passes the lameness filter.

    So, basically I can't provide a post with any information in it if I want it to appear on the site.

    Bye, slashdot, and CmdrTaco -- one last FUCK YOU to you. Shithead.

    --
    "Cause there's 40 different shades of black, so many fortresses and ways to attack, so why you complainin'?"
    1. Re:mozilla source search by Fweeky · · Score: 5, Insightful

      > What follows is my commentary as I tried to get this post under the lameness filter -- resulting in the useless shit post you see above.

      Ugh, yeah, the lameness filter truely is the most evil bit of code Mr Taco ever made/approved. Probably.

      At the very least it should be turned off (or tuned down significantly) for users with lots of karma; if I get to post at +2 I think it's also reasonable to expect I'm not going to post ASCII penis birds etc.

      A few weeks ago I wrote a nice little comment that was mostly a list of points; obviously liking to get proper formatting I threw in the required HTML and was instantly hit by the lameness filter, basically making the HTML formatted mode entirely useless.

      And yes, I admit, my train of thought wasn't entirely different from yours :)

      (said HTML mode also removes a lot of useful HTML I like to use; titles for links in order to describe what I'm linking to better, <abbr> and <acronym> which are nice when using a lot of TLA's and ETLA's, <small> which is useful for notes and something I might even have used for this piece of text, etc. Yet I'm allowed to use elements like <div> that have pretty much zero use? Blegh)

  34. Re:Is this really a problem for us? by electroniceric · · Score: 3, Funny
    But aside from just being a /. poster, you are clearly not the norm because half of MSN's searches come from the address bar, according to Jupiter Media Metrix.

    Considering that most major search engines now place links according to payment, it's a short step to turning the browser, or the whole OS into Bonzi Buddy.

    Not that I would mind if the OS did some contextual search for me to bring up results while I'm working, but I've seen enough ads for the X10 wireless camera, thank you.

  35. Tempest in a teapot? by TheConfusedOne · · Score: 3, Interesting

    First off, Microsoft does the same thing. The only difference is that their automatic search goes to Microsoft and they log there rather than having to do the more obvious redirect.

    Second off, this is only if you use the search button. If you go to google.com and type in your search then Netscape/AOL gets no information.

    Now, let's imagine if they got all the information from you. A unique ID string and all your search queries. They compile this data on your for an entire year. Great. Now, what the hell do they do with it? The only possible use for this would be to detect your string, cross-reference and munge all of this data, and present you with a slightly more targeted pop-up ad.

    Well, guess what, another company already tried this. Remember them? They were called DoubleClick. In that case they had hundreds of web sites helping them to gather all of this information about browsers and what did they do with it? They couldn't turn a profit, they couldn't even target ads very well (if at all).

    Think about it people. Yeah, it stinks that they're gathering this information. Yeah, they should be more forthcoming about what happens when you hit that Search button. Sure you can go an boycott them and add this to the '1 bazillion + 1 reasons that AOL is evil' list, but in the end, what does this get them?

    Nada.

    --
    --- I wish I could hear the soundtrack to my life. That way I'd know when to duck.
  36. Re:What's the betting... by stinky+wizzleteats · · Score: 4, Informative

    Well, I just did packet traces, and the results are troubling.

    It's for real. No error reporting, no background windows. Search with the button, info goes to Netscape. Search without it, and you don't see the spyware traffic. But it gets worse.

    I haven't tested this with the Linux version of Mozilla, so this might be a weird code overlap issue, but Win32 Mozilla build 2002030403 does the same thing.

  37. What's in that query bar packet? by jscribner · · Score: 5, Informative

    So i was curious about what was actually being sent to AOL when one did a google search from the netscape bar. Here's the HTTP request:
    GET /fwd/lksidus_gg/http://www.google.com/search?q=tes tpriv9&sourceid=mozilla-search HTTP/1.1
    Host: info.netscape.com
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1
    Accept: text/xml, application/xml, application/xhtml+xml, text/html;q=0.9, image/png, image/jpeg, image/gif;q=0.2, text/plain;q=0.8, text/css, */*;q=0.1
    Accept-Language: en-us
    Accept-Encoding: gzip,deflate,compress,identity
    Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66
    Keep-Alive: 300
    Connection: keep-alive

    There's also the usual data stuffed in the TCPIP header, such as IP address. There are some additional g'day requests to info.netscape.com which might contain unique ID information and would also be matched to TCPIP header info, but if there are any explicit UIDs in this packet i must be missing em.

    The developers probably had a good reason for setting things up this way: If the URL for a search engine changed, they could always update their fwd script and prevent users from going to a broken page. Unfortunately, this means data gets sent to a site other than that intended by the user. A much better way of doing this would be for the client to check for updates to the search URLs and store them locally.

    Just some thoughts.

    --
    JS - IBM Metaverse devteam
    The opinions expressed here are mine & not necessarily representative of IBM
  38. Re:Big deal by jilles · · Score: 4, Insightful

    In some countries there are laws against collecting data that can be related to individuals without the individuals permission. Also in most countries, upholding a "click to agree" license in court would be tricky at best.

    These two combined probably makes netscape's actions illegal in some countries. Why are people making a fuss about it? After all netscape's intentions are probably pretty harmless.

    However, there's no way of knowing for sure and would you really want your queries for porn of a very dubious nature logged by AOL? What if you're a chinese and you enter "falung gong" in the search field? In China that information about you is likely to get you some very special attention of the local authority.

    In short, privacy matters. You own your data and stealing it (i.e. taking it without your knowledge) violates your privacy since you are not in control of what is stored and who has access to it.

    Suppose you want to apply for a job at AOL (ok that's a bit extreme, I know) and the nice guy who does the interviews does a query on the netscape DB to see what kind of searches you've been doing and subsequently shows you the door. So, first they invade your privacy and then they use that information against you.

    This kind of scenario's is of course not very likely but Murphy's law tells us that if it can happen it will happen. Allowing companies to secretely log privacy sensitive data will at some point have negative consequences. All that data will just be sitting there waiting to be used by whomever has access to it. The data is valuable (that's why it's being collected) and customers of that data will want to use that data for whatever is in their interest.

    That's why you don't want any spyware on your computer.

    Now probably Netscape's intentions are pretty harmless. Probably netscape's programmers are just as clueless about privacy as most other computer users.

    --

    Jilles
  39. Re:What's the betting... by Tackhead · · Score: 3, Interesting
    > So what exactly is my information worth to these people? What is the going rate for the fact that I made a search for 'Mount Washington' on google this morning?
    >
    > Can I sell it for $.35? 5.35? I'm just curious. Perhaps I could put that in Ebay.

    Depends on what happens to Mount Washington, doesn't it?

    What would you pay for a list of all "WTC evacuation shortest route" queries dated September 10th?

  40. Re:But there's a major difference by freakinPsycho · · Score: 3, Insightful

    Not in Netscape, you can't.

    Netscape is a comercial product. Mozilla is not, but that's not what we're talking about.

    The hypocracy here is that people are saying "oh, it's Netscape, so I'll believe whatever they tell me and think it's ok."

    Let's face it, if IE sent information about your searches back to Microsoft, you would have a screaming fit. Even if there was an option to turn that off, you would still be cry foul.

    I have seen this many times on /. OSS supporting company A does something that is terrible. Huge security hole, gathering of data, etc. It is brought up and defended here.

    If Microsoft does it, all hell is raised.

    The PR release for both can be the same, basically saying "look, we're not actually doing anything with this information. it goes to our servers, sits there and is eventually used to get a general profile of our users without any specific information being applied to anyone." If OSS supporting company does, that's fine. Microsoft does it, it's a lie and a furthering of their monopolistic strategies.

    I'm not defending Microsoft. All I'm doing is pointing out the double standard of many here.

    --
    "All the things I really like to do are either immoral, illegal, or fattening."
    - Alexandar Woolcot
  41. Re:any surprise? by tkrotchko · · Score: 3, Interesting

    "They invented cookies so that advertisers could track readers "

    Cookies primary use is to keep state information. Many legitimate sites use cookies, and most could care less about tracking you.

    While its true cookies can be used to track user habits (and this is a stretch), modern browsers make this much more difficult. For example, for at least 2 versions IE hasn't allowed URL or javascript requests for out-of-domain requests.

    In fact IE6 even eliminates this problem for the most part through its use of rejecting cookies that don't come from the primary URL the user is viewing.

    There are a lot of threats to privacy. Cookies aren't the worst offender by a long shot.

    --
    You were mistaken. Which is odd, since memory shouldn't be a problem for you
  42. Re:any surprise? by JamesOfTheDesert · · Score: 4, Insightful
    There's a difference between suspected peeping toms and convicted rapists ( sorry -- I guess Micro$oft still on appeal for their conviction ).

    Wow. Comparing Microsoft to a rapist. Let me guess: you're a guy, and you probably don't even *know* any women.

    Am I right?

    I *knew* it!

    Here's a tip: If you want to make clever analogies, avoid glib references to crimes of sexual violence that destroy lives. Half the population will appreciate your effort.

    And maybe chicks will finally talk to you.

    --

    Java is the blue pill
    Choose the red pill
  43. Using Junkbuster to block this by Larry_Dillon · · Score: 3, Informative

    I think I've got an entry for Junkbuster's re_filterfile that will strip the info.netscape.com stuff and just take you directly to google's search results:

    s/'http://info.netscape.com/fwd/lksidus_gg/'///i g

    Just remember to restart junkbuster.

    Don't know what Junkbuster is? See junkbuster.com

    --
    Competition Good, Monopoly Bad.
  44. Re: Parenthetical comment (last one) by twilight30 · · Score: 3, Interesting

    I wonder if there could be some way to represent the information in the article to users. The EULA would be the ideal place to put this, in the true sense of the word. Where 'ideal' meant 'never reflected in reality'. People wouldn't read it.

    The point is, people aren't even really given the opportunity to find out about this. Only the technically-minded have found out about it, and only they will do something to address the situation. Shouldn't AOL/Netscape tell you what they are doing?

    --
    ========================================
    Death will come, and will have your eyes
    -- Pavese
  45. Read the licensing, silly by rickmoen · · Score: 3, Insightful
    cnkeller wrote:

    If netscape needs information to sell/share to it's partners so it can get more revenue and keep producing great products, that's fine. You don't have to use their browser. A more interesting question is that did you agree to it in the EULA?

    I'm glad you asked that question. No, he did not.

    I happen to maintain an archive of licence agreements for common proprietary Linux software, including the one for Netscape 6.1. It includes a clause that the "he Product may automatically send information relating to the download and install process to Netscape", but nothing about post-installation spying.

    Rick Moen
    rick@linuxmafia.com

  46. Changing face of computing by DunbarTheInept · · Score: 5, Interesting

    I can remember the days when logging someone's IP address was *never* used as a means of determining unique individuals because people who wrote this software actually understood how computers actually worked, and thus understood that one computer is not the same thing as one user. I used to run Netscape off of a server onto X-terminal
    software, along with several office-mates at the same time. It used to work just fine, until sites started assuming one IP == one user, and got their cookies horribly confused when we'd both hit the same site. I remember once getting the shopping cart for someone else popping up on my screen at a computer parts seller website - sure enough it thought I was him because we had the same IP.
    We would also have problems trying to reply to online surveys, which would falsely accuse us of being one person trying to double-vote.

    But now that most people browse via Windows sites have started assuming that it's just plain impossible for two different people to have the same IP address.

    Again, as always, I blame Microsoft for dumbing-down the computer industry and removing functionality by making their crippled system the only standard people have to bother supporting.

    --

    Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.

  47. Re:Netscape, IE and Mozilla by DunbarTheInept · · Score: 3, Insightful

    Speed of loading the program into memory is irrelevant. Opera is faster at rendering the pages, and that's what was being talked about.

    --

    Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.